S.B. 72

- *SB72*

SENATE BILL NO. 72–COMMITTEE ON GOVERNMENT AFFAIRS

(ON BEHALF OF THE DIVISION OF ENTERPRISE

INFORMATION TECHNOLOGY SERVICES)

PREFILED DECEMBER 20, 2014 ____________

Referred to Committee on Government Affairs

SUMMARY—Makes various changes relating to the Division of

Enterprise Information Technology Services of the Department of Administration. (BDR 19-310)

FISCAL NOTE: Effect on Local Government: No. Effect on the State: Yes.

~

EXPLANATION – Matter in bolded italics is new; matter between brackets [omitted material] is material to be omitted.

AN ACT relating to information technology; amending the composition and responsibilities of the Division; providing that the Administrator of the Division is the Chief Information Officer of the State; providing that certain policies, standards, guidelines and procedures set forth by the Administrator apply to the Nevada Criminal Justice Information System; amending the membership and duties of the Information Technology Advisory Board; requiring the Department of Public Safety to use the services and equipment of the Division; authorizing the Administrator to accept any money from a public or private source for deposit into the Fund for Information Services; making various other changes relating to the Division; and providing other matters properly relating thereto.

Legislative Counsel’s Digest: Existing law creates the Division of Enterprise Information Technology 1 Services of the Department of Administration to provide various information 2 services, systems and technology to certain state officers and agencies. (NRS 3 242.080, 242.131) The Division consists of: (1) the Administrator of the Division; 4 (2) the Enterprise Application Services Unit; (3) the Communication and 5 Computing Unit; and (4) the Office of Information Security. Section 3 of this bill: 6 (1) eliminates the Enterprise Application Services Unit, the Communication and 7

– 2 –

- *SB72*

Computing Unit and the Office of Information Security; and (2) provides that the 8 Division consists of the Administrator and such other personnel employed by the 9 Administrator. Sections 5, 14-16, 18, 20-26, 28 and 29 of this bill make 10 conforming changes. 11 Sections 4 and 19 of this bill provide that the Administrator is the Chief 12 Information Officer of the State. 13 Existing law requires the Administrator to adopt regulations and develop 14 certain policies, standards, guidelines and procedures relating to information 15 systems of the Executive Branch of Government other than the Nevada System of 16 Higher Education and the Nevada Criminal Justice Information System. (NRS 17 242.111, 242.115) Sections 6 and 7 of this bill provide that such regulations, 18 policies, standards, guidelines and procedures apply to the Nevada Criminal Justice 19 Information System. 20 Existing law creates the Information Technology Advisory Board and sets forth 21 the duties of the Board, which include reviewing the Division’s standards manual 22 for information technology. (NRS 242.122, 242.124) Section 8 of this bill revises 23 the membership of the Board. Section 10 of this bill eliminates the requirement that 24 the Board review the Division’s standards manual and adds a requirement that the 25 Board review the Division’s guidelines to assist using agencies in the development 26 of short-term and long-term plans for their information systems. 27 Existing law requires the Board to meet at least once every 3 months. (NRS 28 242.123) Section 9 of this bill requires the Board to meet at least three times per 29 calendar year. 30 Existing law provides, with limited exceptions, that all state agencies and 31 elected state officers use the services and equipment of the Division for information 32 systems. (NRS 242.131) Section 11 of this bill requires the Department of Public 33 Safety to use such services and equipment. 34 Section 13 of this bill provides that the Division is responsible for providing 35 network servers, including, without limitation, mainframe computers, for agencies 36 and officers that use the equipment and services of the Division. 37 Existing law requires any state agency or elected officer which uses the 38 equipment or services of the Division to adhere to the regulations, standards, 39 practices, policies and conventions of the Division. (NRS 242.161, 242.181) 40 Sections 12 and 14 of this bill provide that if a state agency or elected officer does 41 not so adhere, the Administrator may prohibit the state agency or elected officer 42 from using the equipment or services of the Division. 43 Section 15 of this bill requires the Division to investigate and resolve any 44 attempted breach, in addition to an actual breach, of an information system of a 45 state agency or elected officer that uses the equipment or services of the Division. 46 Existing law creates the Fund for Information Services as an internal service 47 fund. Money in the Fund must be used to pay all operating, maintenance, rental, 48 repair and replacement costs of equipment and all salaries of personnel assigned to 49 the Division. (NRS 242.211) Section 17 of this bill authorizes the Administrator to 50 accept grants, gifts, donations, bequests, devises or other money from a public or 51 private source for deposit in the Fund. 52 Existing law: (1) provides that certain records which relate to homeland 53 security and are maintained by the Division are confidential; and (2) requires the 54 Administrator to maintain a list of such records and submit an annual report 55 concerning such records to the Director of the Legislative Counsel Bureau. (NRS 56 242.105) Sections 1 and 29 of this bill eliminate those provisions. 57

– 3 –

- *SB72*

THE PEOPLE OF THE STATE OF NEVADA, REPRESENTED IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:

Section 1. NRS 239.010 is hereby amended to read as follows: 1 239.010 1. Except as otherwise provided in this section and 2 NRS 1.4683, 1A.110, 49.095, 62D.420, 62D.440, 62E.516, 3 62E.620, 62H.025, 62H.030, 62H.170, 62H.220, 62H.320, 76.160, 4 78.152, 80.113, 81.850, 82.183, 86.246, 86.54615, 87.515, 87.5413, 5 87A.200, 87A.580, 87A.640, 88.3355, 88.5927, 88.6067, 88A.345, 6 88A.7345, 89.045, 89.251, 90.730, 91.160, 116.757, 116A.270, 7 116B.880, 118B.026, 119.260, 119.265, 119.267, 119.280, 8 119A.280, 119A.653, 119B.370, 119B.382, 120A.690, 125.130, 9 125B.140, 126.141, 126.161, 126.163, 126.730, 127.007, 127.057, 10 127.130, 127.140, 127.2817, 130.312, 159.044, 172.075, 172.245, 11 176.015, 176.0625, 176.09129, 176.156, 176A.630, 178.39801, 12 178.4715, 178.5691, 179.495, 179A.070, 179A.165, 179A.450, 13 179D.160, 200.3771, 200.3772, 200.5095, 200.604, 202.3662, 14 205.4651, 209.392, 209.3925, 209.419, 209.521, 211A.140, 15 213.010, 213.040, 213.095, 213.131, 217.105, 217.110, 217.464, 16 217.475, 218E.625, 218F.150, 218G.130, 218G.240, 218G.350, 17 228.270, 228.450, 228.495, 228.570, 231.069, 233.190, 237.300, 18 239.0105, 239.0113, 239B.030, 239B.040, 239B.050, 239C.140, 19 239C.210, 239C.230, 239C.250, 239C.270, 240.007, 241.020, 20 241.030, [242.105,] 244.264, 244.335, 250.087, 250.130, 250.140, 21 250.150, 268.095, 268.490, 268.910, 271A.105, 281.195, 281A.350, 22 281A.440, 281A.550, 284.4068, 286.110, 287.0438, 289.025, 23 289.080, 289.387, 293.5002, 293.503, 293.558, 293B.135, 24 293D.510, 331.110, 332.061, 332.351, 333.333, 333.335, 338.070, 25 338.1379, 338.1725, 338.1727, 348.420, 349.597, 349.775, 353.205, 26 353A.085, 353A.100, 353C.240, 360.240, 360.247, 360.255, 27 360.755, 361.044, 361.610, 365.138, 366.160, 368A.180, 372A.080, 28 378.290, 378.300, 379.008, 386.655, 387.626, 387.631, 388.5275, 29 388.528, 388.5315, 388.750, 391.035, 392.029, 392.147, 392.264, 30 392.271, 392.652, 392.850, 394.167, 394.1698, 394.447, 394.460, 31 394.465, 396.3295, 396.405, 396.525, 396.535, 398.403, 408.3885, 32 408.3886, 412.153, 416.070, 422.290, 422.305, 422A.320, 33 422A.350, 425.400, 427A.1236, 427A.872, 432.205, 432B.175, 34 432B.280, 432B.290, 432B.407, 432B.430, 432B.560, 433.534, 35 433A.360, 439.270, 439.840, 439B.420, 440.170, 441A.195, 36 441A.220, 441A.230, 442.330, 442.395, 445A.665, 445B.570, 37 449.209, 449.245, 449.720, 453.1545, 453.720, 453A.610, 38 453A.700, 458.055, 458.280, 459.050, 459.3866, 459.555, 39 459.7056, 459.846, 463.120, 463.15993, 463.240, 463.3403, 40 463.3407, 463.790, 467.1005, 467.137, 481.063, 482.170, 482.5536, 41 483.340, 483.363, 483.800, 484E.070, 485.316, 503.452, 522.040, 42

– 4 –

- *SB72*

534A.031, 561.285, 571.160, 584.583, 584.655, 598.0964, 1 598.0979, 598.098, 598A.110, 599B.090, 603.070, 603A.210, 2 604A.710, 612.265, 616B.012, 616B.015, 616B.315, 616B.350, 3 618.341, 618.425, 622.310, 623.131, 623A.353, 624.110, 624.265, 4 624.327, 625.425, 625A.185, 628.418, 629.069, 630.133, 5 630.30665, 630.336, 630A.555, 631.368, 632.121, 632.125, 6 632.405, 633.283, 633.301, 633.524, 634.212, 634.214, 634A.185, 7 635.158, 636.107, 637.085, 637A.315, 637B.288, 638.087, 638.089, 8 639.2485, 639.570, 640.075, 640A.220, 640B.730, 640C.400, 9 640C.745, 640C.760, 640D.190, 640E.340, 641.090, 641A.191, 10 641B.170, 641C.760, 642.524, 643.189, 644.446, 645.180, 645.625, 11 645A.050, 645A.082, 645B.060, 645B.092, 645C.220, 645C.225, 12 645D.130, 645D.135, 645E.300, 645E.375, 645G.510, 645H.320, 13 645H.330, 647.0945, 647.0947, 648.033, 648.197, 649.065, 14 649.067, 652.228, 654.110, 656.105, 661.115, 665.130, 665.133, 15 669.275, 669.285, 669A.310, 671.170, 673.430, 675.380, 676A.340, 16 676A.370, 677.243, 679B.122, 679B.152, 679B.159, 679B.190, 17 679B.285, 679B.690, 680A.270, 681A.440, 681B.260, 681B.280, 18 683A.0873, 685A.077, 686A.289, 686B.170, 686C.306, 687A.110, 19 687A.115, 687C.010, 688C.230, 688C.480, 688C.490, 692A.117, 20 692C.190, 692C.420, 693A.480, 693A.615, 696B.550, 703.196, 21 704B.320, 704B.325, 706.1725, 710.159, 711.600, sections 35, 38 22 and 41 of chapter 478, Statutes of Nevada 2011 and section 2 of 23 chapter 391, Statutes of Nevada 2013 and unless otherwise declared 24 by law to be confidential, all public books and public records of a 25 governmental entity must be open at all times during office hours to 26 inspection by any person, and may be fully copied or an abstract or 27 memorandum may be prepared from those public books and public 28 records. Any such copies, abstracts or memoranda may be used to 29 supply the general public with copies, abstracts or memoranda of the 30 records or may be used in any other way to the advantage of the 31 governmental entity or of the general public. This section does not 32 supersede or in any manner affect the federal laws governing 33 copyrights or enlarge, diminish or affect in any other manner the 34 rights of a person in any written book or record which is 35 copyrighted pursuant to federal law. 36 2. A governmental entity may not reject a book or record 37 which is copyrighted solely because it is copyrighted. 38 3. A governmental entity that has legal custody or control of a 39 public book or record shall not deny a request made pursuant to 40 subsection 1 to inspect or copy or receive a copy of a public book or 41 record on the basis that the requested public book or record 42 contains information that is confidential if the governmental 43 entity can redact, delete, conceal or separate the confidential 44

– 5 –

- *SB72*

information from the information included in the public book or 1 record that is not otherwise confidential. 2 4. A person may request a copy of a public record in any 3 medium in which the public record is readily available. An officer, 4 employee or agent of a governmental entity who has legal custody 5 or control of a public record: 6 (a) Shall not refuse to provide a copy of that public record in a 7 readily available medium because the officer, employee or agent has 8 already prepared or would prefer to provide the copy in a different 9 medium. 10 (b) Except as otherwise provided in NRS 239.030, shall, upon 11 request, prepare the copy of the public record and shall not require 12 the person who has requested the copy to prepare the copy himself 13 or herself. 14 Sec. 2. NRS 242.071 is hereby amended to read as follows: 15 242.071 1. The Legislature hereby determines and declares 16 that the creation of the Division of Enterprise Information 17 Technology Services of the Department of Administration is 18 necessary for the coordinated, orderly and economical processing 19 of information in State Government, to ensure economical use of 20 information systems and to prevent the unnecessary proliferation of 21 equipment and personnel among the various state agencies. 22 2. The purposes of the Division are: 23 (a) To perform information services for state agencies [.] , as 24 directed by the Governor. 25 (b) To provide technical advice but not administrative control of 26 the information systems within the state agencies and, as authorized, 27 of local governmental agencies. 28 Sec. 3. NRS 242.080 is hereby amended to read as follows: 29 242.080 1. The Division of Enterprise Information 30 Technology Services of the Department is hereby created. 31 2. The Division consists of the Administrator and [the: 32 (a) Enterprise Application Services Unit. 33 (b) Communication and Computing Unit. 34 (c) Office of Information Security. 35 3. A Communications Group and a Telecommunications Group 36 are hereby created within the Communication and Computing Unit 37 of the Division.] such other personnel employed by the 38 Administrator to carry out the provisions of this chapter. 39 Sec. 4. NRS 242.090 is hereby amended to read as follows: 40 242.090 1. The Director of the Department shall appoint the 41 Administrator in the unclassified service of the State. 42 2. The Administrator: 43

– 6 –

- *SB72*

(a) Serves at the pleasure of, and is responsible to, the Director 1 of the Department. 2 (b) Shall not engage in any other gainful employment or 3 occupation. 4 (c) Is the Chief Information Officer of the State. 5 Sec. 5. NRS 242.101 is hereby amended to read as follows: 6 242.101 1. The Administrator shall: 7 (a) [Appoint the heads of the Enterprise Application Services 8 Unit and the Communication and Computing Unit of the Division in 9 the unclassified service of the State; 10 (b) Appoint the Chief of the Office of Information Security who 11 is in the classified service of the State; 12 (c)] Administer the provisions of this chapter and other 13 provisions of law relating to the duties of the Division; and 14 [(d) Carry] 15 (b) Appoint such personnel as necessary to carry out other 16 duties and exercise other powers specified by law. 17 2. The Administrator may form committees to establish 18 standards and determine criteria for evaluation of policies relating to 19 informational services. 20 Sec. 6. NRS 242.111 is hereby amended to read as follows: 21 242.111 The Administrator shall adopt regulations necessary 22 for the administration of this chapter, including: 23 1. The policy for the information systems of the Executive 24 Branch of Government, excluding the Nevada System of Higher 25 Education , [and the Nevada Criminal Justice Information System,] 26 as that policy relates, but is not limited, to such items as standards 27 for systems and programming and criteria for selection, location and 28 use of information systems to meet the requirements of state 29 agencies and officers at the least cost to the State; 30 2. The procedures of the Division in providing information 31 services, which may include provision for the performance, by an 32 agency which uses the services or equipment of the Division ; [, of 33 preliminary procedures, such as data recording and verification, 34 within the agency;] 35 3. The effective administration of the Division, including, 36 without limitation, management of the state network and data 37 centers, security to prevent unauthorized access to information 38 systems and plans for the recovery of systems and applications after 39 they have been disrupted; 40 4. The development of standards to ensure the security of the 41 information systems of the Executive Branch of Government; and 42 5. Specifications and standards for the employment of all 43 personnel of the Division. 44

– 7 –

- *SB72*

Sec. 7. NRS 242.115 is hereby amended to read as follows: 1 242.115 1. Except as otherwise provided in subsection 2, the 2 Administrator shall: 3 (a) Develop policies and standards for the information systems 4 of the Executive Branch of Government; 5 (b) Coordinate the development of a biennial state plan for the 6 information systems of the Executive Branch of Government; 7 (c) Develop guidelines to assist state agencies in the 8 development of short- and long-term plans for their information 9 systems; and 10 (d) Develop guidelines and procedures for the procurement and 11 maintenance of the information systems of the Executive Branch of 12 Government. 13 2. This section does not apply to the Nevada System of Higher 14 Education . [or the Nevada Criminal Justice Information System 15 used to provide support for the operations of law enforcement 16 agencies in this State.] 17 Sec. 8. NRS 242.122 is hereby amended to read as follows: 18 242.122 1. There is hereby created an Information 19 Technology Advisory Board. The Board consists of: 20 (a) One member appointed by the Majority Floor Leader of the 21 Senate from the membership of the Senate Standing Committee on 22 Finance. 23 (b) One member appointed by the Speaker of the Assembly 24 from the membership of the Assembly Standing Committee on 25 Ways and Means. 26 (c) [Two] Three representatives of using agencies which are 27 major users of [the services of the Division. The Governor shall 28 appoint the two representatives.] information technology appointed 29 by the Governor. Each such representative serves for a term of 4 30 years. For the purposes of this paragraph, an agency is a “major 31 user” if it is among the top five users of [the] information services , 32 [of the Division,] based on the amount of money paid by each 33 agency for [the] information services [of the Division] during the 34 immediately preceding biennium. 35 (d) The [Director of the Department or his or her designee. 36 (e) The Attorney General or his or her designee. 37 (f) Five] Chief of the Budget Division of the Department. 38 (e) Three persons appointed by the Governor as follows: 39 (1) [Three persons] One person who [represent] represents a 40 city or county in this State [, at least one of whom] and is engaged 41 in information technology or information security; and 42 (2) Two persons who represent the information technology 43 industry but who: 44 (I) Are not employed by this State; and 45

– 8 –

- *SB72*

(II) Do not hold any elected or appointed office in State 1 Government . [; 2 (III) Do not have an existing contract or other agreement 3 to provide information services, systems or technology to an agency 4 of this State; and 5 (IV) Are independent of and have no direct or indirect 6 pecuniary interest in a corporation, association, partnership or other 7 business organization which provides information services, systems 8 or technology to an agency of this State.] 9 2. Each person appointed pursuant to paragraph [(f)] (e) of 10 subsection 1 serves for a term of 4 years. No person so appointed 11 may serve more than 2 consecutive terms. 12 3. At the first regular meeting of each calendar year, the 13 members of the Board shall elect a Chair by majority vote. 14 Sec. 9. NRS 242.123 is hereby amended to read as follows: 15 242.123 1. The Board shall meet at least [once every 3 16 months] three times per calendar year and may meet at such further 17 times as deemed necessary by the Chair. 18 2. Members of the Board who are officers or employees of the 19 Executive Department of State Government serve without additional 20 compensation. Members who are not officers or employees of the 21 Executive Department of State Government are entitled to a salary 22 of $80 for each day or part of a day spent on the business of the 23 Board. All members of the Board are entitled to receive the per diem 24 allowance and travel expenses provided for state officers and 25 employees generally. 26 Sec. 10. NRS 242.124 is hereby amended to read as follows: 27 242.124 1. The Board shall: 28 (a) Advise the Division concerning issues relating to 29 information technology, including, without limitation, the 30 development, acquisition, consolidation and integration of, and 31 policies, planning and standards for, information technology. 32 (b) Periodically review the Division’s statewide strategic plans 33 and [standards manual for information technology.] guidelines to 34 assist using agencies in the development of short-term and long-35 term plans for their information systems. 36 (c) Review the Division’s proposed budget before its submission 37 to the Budget Division of the Department . [of Administration.] 38 2. The Board may: 39 (a) With the consent of the Division, recommend goals and 40 objectives for the Division, including periods and deadlines in 41 which to achieve those goals and objectives. 42 (b) Upon request by a using agency, review issues and policies 43 concerning information technology to resolve disputes with the 44 Division. 45

– 9 –

- *SB72*

(c) Review the plans for information technology of each using 1 agency. 2 Sec. 11. NRS 242.131 is hereby amended to read as follows: 3 242.131 1. The Division shall provide state agencies and 4 elected state officers with all their required design of information 5 systems. All agencies and officers must use those services and 6 equipment, except as otherwise provided in subsection 2 [.] and 7 subsection 1 of NRS 242.181. 8 2. The following agencies may negotiate with the Division for 9 its services or the use of its equipment, subject to the provisions of 10 this chapter, and the Division shall provide those services and the 11 use of that equipment as may be mutually agreed: 12 (a) The Court Administrator; 13 (b) The Department of Motor Vehicles; 14 (c) [The Department of Public Safety; 15 (d)] The Department of Transportation; 16 [(e)] (d) The Employment Security Division of the Department 17 of Employment, Training and Rehabilitation; 18 [(f)] (e) The Department of Wildlife; 19 [(g)] (f) The Housing Division of the Department of Business 20 and Industry; 21 [(h)] (g) The Legislative Counsel Bureau; 22 [(i)] (h) The State Controller; 23 [(j)] (i) The State Gaming Control Board and Nevada Gaming 24 Commission; and 25 [(k)] (j) The Nevada System of Higher Education. 26 3. Any state agency or elected state officer not described in 27 subsection 2 who [uses the services of the Division and] desires to 28 withdraw [substantially] from [that use] receiving information 29 services or information systems from the Division must apply to 30 the Administrator for approval. The application must set forth 31 justification for the withdrawal. The Administrator shall, in 32 consultation with the Governor, determine whether to approve or 33 deny the application. If the Administrator denies the application, the 34 agency or officer must: 35 (a) If the Legislature is in regular or special session, obtain the 36 approval of the Legislature by concurrent resolution. 37 (b) If the Legislature is not in regular or special session, obtain 38 the approval of the Interim Finance Committee. The Administrator 39 shall, within 45 days after receipt of the application, forward the 40 application together with his or her recommendation for approval or 41 denial to the Interim Finance Committee. The Interim Finance 42 Committee has 45 days after the application and recommendation 43 are submitted to its Secretary within which to consider the 44

– 10 –

- *SB72*

application. Any application which is not considered by the 1 Committee within the 45-day period shall be deemed approved. 2 4. If the demand for services or use of equipment exceeds the 3 capability of the Division to provide them, the [Division] 4 Administrator may authorize a using agency to contract with other 5 agencies or independent contractors to furnish the required services 6 or use of equipment . [and] The using agency is responsible for the 7 administration of the contracts. 8 Sec. 12. NRS 242.161 is hereby amended to read as follows: 9 242.161 1. All equipment of an agency or elected state 10 officer which is owned or leased by the State must be under the 11 managerial control of the Division, except the equipment of the 12 agencies and officers specified in subsection 2 of NRS 242.131 [.] 13 and subsection 1 of NRS 242.181. 14 2. The Division may permit an agency which is required to use 15 such equipment to operate it on the agency’s premises. 16 Sec. 13. NRS 242.171 is hereby amended to read as follows: 17 242.171 1. The Division is responsible for: 18 (a) The applications of information systems; 19 (b) Designing and placing those information systems in 20 operation; 21 (c) Providing network servers, including, without limitation, 22 mainframe computers; 23 (d) Any application of an information system which it furnishes 24 to state agencies and officers after negotiation; and 25 [(d)] (e) The security validation, testing, including, without 26 limitation, penetration testing, and continuous monitoring of 27 information systems, 28 for using agencies and for state agencies and officers which use 29 the equipment or services of the Division pursuant to subsection 2 of 30 NRS 242.131. 31 2. The Administrator shall review and approve or disapprove, 32 pursuant to standards for justifying cost, any application of an 33 information system having an estimated developmental cost of 34 $50,000 or more. No using agency may commence development 35 work on any such applications until approval and authorization have 36 been obtained from the Administrator. 37 3. As used in this section, “penetration testing” means a 38 method of evaluating the security of an information system or 39 application of an information system by simulating unauthorized 40 access to the information system or application. 41 Sec. 14. NRS 242.181 is hereby amended to read as follows: 42 242.181 1. Any state agency or elected state officer which 43 uses the equipment or services of the Division shall adhere to the 44 regulations, standards, practices, policies and conventions of the 45

– 11 –

- *SB72*

Division. If any such state agency or elected officer does not 1 adhere to the regulations, standards, practices, policies and 2 conventions, the Administrator may prohibit the state agency or 3 elected officer from using the equipment or services of the 4 Division. 5 2. Each state agency or elected state officer described in 6 subsection 1 shall report any suspected incident of: 7 (a) Unauthorized access or an attempt to gain unauthorized 8 access to an information system or application of an information 9 system of the Division used by the state agency or elected state 10 officer or of an information system of the state agency or elected 11 state officer; and 12 (b) Noncompliance with the regulations, standards, practices, 13 policies and conventions of the Division that is identified by the 14 Division as security-related, 15 to the [Office of Information Security of the Division] 16 Administrator, or his or her designee, within 24 hours after 17 discovery of the suspected incident. [If the Office determines that an 18 incident of unauthorized access or noncompliance occurred, the 19 Office shall immediately report the incident to the Administrator.] 20 The Administrator , or his or her designee, shall assist in the 21 investigation and resolution of any such incident. 22 3. The Division shall provide services to each state agency and 23 elected state officer described in subsection 1 uniformly with respect 24 to degree of service, priority of service, availability of service and 25 cost of service. 26 Sec. 15. NRS 242.183 is hereby amended to read as follows: 27 242.183 1. The [Chief of the Office of Information Security] 28 Division shall investigate and resolve any breach or attempted 29 breach of an information system of a state agency or elected officer 30 that uses the equipment or services of the Division or an application 31 of such an information system or unauthorized acquisition of 32 computerized data that materially compromises or could have 33 materially compromised the security, confidentiality or integrity of 34 such an information system. 35 2. The Administrator or [Chief of the Office of Information 36 Security, at] his or her designee, at the Administrator’s discretion, 37 may inform members of the Technological Crime Advisory 38 Board created by NRS 205A.040, the Nevada Commission on 39 Homeland Security created by NRS 239C.120 and the Information 40 Technology Advisory Board created by NRS 242.122 of any breach 41 or attempted breach of an information system of a state agency or 42 elected officer or application of such an information system or 43 unauthorized acquisition of computerized data that materially 44

– 12 –

- *SB72*

compromises or could have materially compromised the security, 1 confidentiality or integrity of such an information system. 2 Sec. 16. NRS 242.191 is hereby amended to read as follows: 3 242.191 1. Except as otherwise provided in subsection 3, the 4 amount receivable from a state agency or officer or local 5 governmental agency which uses the services of the Division must 6 be determined by the Administrator in each case and include: 7 (a) The annual expense, including depreciation, of operating and 8 maintaining the [Communication and Computing Unit,] Division, 9 distributed among the agencies or officers in proportion to the 10 services performed for each agency [.] or officer. 11 (b) A service charge in an amount determined by distributing the 12 monthly installment for the construction costs of the computer 13 facility among the agencies or officers in proportion to the services 14 performed for each agency [.] or officer. 15 2. The Administrator shall prepare and submit monthly to the 16 state agencies and officers and local governmental agencies for 17 which services of the Division have been performed an itemized 18 statement of the amount receivable from each state agency or officer 19 or local governmental agency. 20 3. The Administrator may authorize, if in his or her judgment 21 the circumstances warrant, a fixed cost billing, including a factor for 22 depreciation, for services rendered to a state agency or officer or 23 local governmental agency. 24 Sec. 17. NRS 242.211 is hereby amended to read as follows: 25 242.211 1. The Fund for Information Services is hereby 26 created as an internal service fund. Money from the Fund must be 27 paid out on claims as other claims against the State are paid. The 28 claims must be made in accordance with budget allotments and are 29 subject to postaudit examination and approval. The Administrator 30 may accept grants, gifts, donations, bequests, devises or other 31 money from a public or private source for deposit in the Fund. 32 2. All operating, maintenance, rental, repair and replacement 33 costs of equipment and all salaries of personnel assigned to the 34 Division must be paid from the Fund. 35 3. Each agency using the services of the Division shall pay a 36 fee for that use to the Fund, which must be set by the Administrator 37 in an amount sufficient to reimburse the Division for the entire cost 38 of providing those services, including overhead. Each using agency 39 shall budget for those services. All fees, proceeds from the sale of 40 equipment and any other money received by the Division must be 41 deposited with the State Treasurer for credit to the Fund. 42 Sec. 18. NRS 205.4765 is hereby amended to read as follows: 43 205.4765 1. Except as otherwise provided in subsection 6, a 44 person who knowingly, willfully and without authorization: 45

– 13 –

- *SB72*

(a) Modifies; 1 (b) Damages; 2 (c) Destroys; 3 (d) Discloses; 4 (e) Uses; 5 (f) Transfers; 6 (g) Conceals; 7 (h) Takes; 8 (i) Retains possession of; 9 (j) Copies; 10 (k) Obtains or attempts to obtain access to, permits access to or 11 causes to be accessed; or 12 (l) Enters, 13 data, a program or any supporting documents which exist inside 14 or outside a computer, system or network is guilty of a 15 misdemeanor. 16 2. Except as otherwise provided in subsection 6, a person who 17 knowingly, willfully and without authorization: 18 (a) Modifies; 19 (b) Destroys; 20 (c) Uses; 21 (d) Takes; 22 (e) Damages; 23 (f) Transfers; 24 (g) Conceals; 25 (h) Copies; 26 (i) Retains possession of; or 27 (j) Obtains or attempts to obtain access to, permits access to or 28 causes to be accessed, 29 equipment or supplies that are used or intended to be used in a 30 computer, system or network is guilty of a misdemeanor. 31 3. Except as otherwise provided in subsection 6, a person who 32 knowingly, willfully and without authorization: 33 (a) Destroys; 34 (b) Damages; 35 (c) Takes; 36 (d) Alters; 37 (e) Transfers; 38 (f) Discloses; 39 (g) Conceals; 40 (h) Copies; 41 (i) Uses; 42 (j) Retains possession of; or 43

– 14 –

- *SB72*

(k) Obtains or attempts to obtain access to, permits access to or 1 causes to be accessed, 2 a computer, system or network is guilty of a misdemeanor. 3 4. Except as otherwise provided in subsection 6, a person who 4 knowingly, willfully and without authorization: 5 (a) Obtains and discloses; 6 (b) Publishes; 7 (c) Transfers; or 8 (d) Uses, 9 a device used to access a computer, network or data is guilty of a 10 misdemeanor. 11 5. Except as otherwise provided in subsection 6, a person who 12 knowingly, willfully and without authorization introduces, causes to 13 be introduced or attempts to introduce a computer contaminant into 14 a computer, system or network is guilty of a misdemeanor. 15 6. If the violation of any provision of this section: 16 (a) Was committed to devise or execute a scheme to defraud or 17 illegally obtain property; 18 (b) Caused response costs, loss, injury or other damage in excess 19 of $500; or 20 (c) Caused an interruption or impairment of a public service, 21 including, without limitation, a governmental operation, a system of 22 public communication or transportation or a supply of water, gas or 23 electricity, 24 the person is guilty of a category C felony and shall be punished 25 as provided in NRS 193.130, and may be further punished by a fine 26 of not more than $100,000. In addition to any other penalty, the 27 court shall order the person to pay restitution. 28 7. The provisions of this section do not apply to a person 29 performing any testing, including, without limitation, penetration 30 testing, of an information system of an agency that uses the 31 equipment or services of the Division of Enterprise Information 32 Technology Services of the Department of Administration that is 33 authorized by the Administrator of the [Division of Enterprise 34 Information Technology Services or the head of the Office of 35 Information Security of the] Division. As used in this subsection: 36 (a) “Information system” has the meaning ascribed to it in 37 NRS 242.057. 38 (b) “Penetration testing” has the meaning ascribed to it in 39 NRS 242.171. 40 Sec. 19. NRS 223.085 is hereby amended to read as follows: 41 223.085 1. The Governor may, within the limits of available 42 money, employ such persons as he or she deems necessary to 43 provide an appropriate staff for the Office of the Governor, 44 including, without limitation, the Office of Economic Development, 45

– 15 –

- *SB72*

the Office of Science, Innovation and Technology and the 1 Governor’s mansion. Any such employees are not in the classified 2 or unclassified service of the State and, except as otherwise 3 provided in NRS 231.043 and 231.047, serve at the pleasure of the 4 Governor. 5 2. The Governor shall: 6 (a) Determine the salaries and benefits of the persons employed 7 pursuant to subsection 1, within limits of money available for that 8 purpose; and 9 (b) Adopt such rules and policies as he or she deems appropriate 10 to establish the duties and employment rights of the persons 11 employed pursuant to subsection 1. 12 [3. The Governor may: 13 (a) Appoint a Chief Information Officer of the State; or 14 (b) Designate the Administrator as the Chief Information Officer 15 of the State. 16 If the Administrator is so appointed, the Administrator shall serve 17 as the Chief Information Officer of the State without additional 18 compensation. 19 4. As used in this section, “Administrator” means the 20 Administrator of the Division of Enterprise Information Technology 21 Services of the Department of Administration.] 22 Sec. 20. NRS 233F.010 is hereby amended to read as follows: 23 233F.010 As used in this chapter, unless the context otherwise 24 requires, the words and terms defined in NRS 233F.015 to 25 [233F.065,] 233F.060, inclusive, have the meanings ascribed to 26 them in those sections. 27 Sec. 21. NRS 233F.117 is hereby amended to read as follows: 28 233F.117 If a state agency other than the [Communications 29 Group] Division adds equipment which extends the state 30 communications system to another location, the extension, if 31 approved by the Administrator, becomes part of the state 32 communications system. An approved extension of the system is 33 subject to the provisions of this chapter relating to the system. 34 Sec. 22. NRS 233F.260 is hereby amended to read as follows: 35 233F.260 The Board shall provide advice to the 36 [Telecommunications Group] Division on the use of 37 telecommunications by the State Government, including: 38 1. The development of policies, standards, plans and designs; 39 2. The procurement of systems, facilities and services; 40 3. The integration of telecommunications systems with other 41 state and local governmental systems; and 42 4. New technology that may become or is available. 43

– 16 –

- *SB72*

Sec. 23. NRS 233F.270 is hereby amended to read as follows: 1 233F.270 1. The [Telecommunications Group,] Division, 2 with the advice of the Board, shall: 3 (a) Plan, carry out and administer a state telecommunications 4 system. When available at a competitive cost, the 5 [Telecommunications Group] Division shall use the facilities of 6 telephone companies providing local exchange service. 7 (b) Make arrangements for the installation of a central telephone 8 switchboard or switchboards to serve the state offices in one or more 9 buildings as may be practical or feasible. 10 2. The system must be integrated and may include services 11 between the State and any cities, counties and schools. 12 3. The Division may consider for the system all the 13 telecommunications requirements of the State and its political 14 subdivisions. 15 Sec. 24. NRS 459.742 is hereby amended to read as follows: 16 459.742 The Commission, in carrying out its duties and within 17 the limits of legislative appropriations and other available money, 18 may: 19 1. Enter into contracts, leases or other agreements or 20 transactions; 21 2. Provide grants of money to local emergency planning 22 committees to improve their ability to respond to emergencies 23 involving hazardous materials; 24 3. Assist with the development of comprehensive plans for 25 responding to such emergencies in this State; 26 4. Provide technical assistance and administrative support to 27 the [Telecommunications Group of the Communication and 28 Computing Unit of the] Division of Enterprise Information 29 Technology Services of the Department of Administration for the 30 development of systems for communication during such 31 emergencies; 32 5. Provide technical and administrative support and assistance 33 for training programs; 34 6. Develop a system to provide public access to data relating to 35 hazardous materials; 36 7. Support any activity or program eligible to receive money 37 from the Contingency Account for Hazardous Materials; 38 8. Adopt regulations setting forth the manner in which the 39 Division of Emergency Management of the Department shall: 40 (a) Allocate money received by the Division which relates to 41 hazardous materials or is received pursuant to 42 U.S.C. §§ 11001 et 42 seq. or 49 U.S.C. §§ 5101 et seq.; and 43 (b) Approve programs developed to address planning for and 44 responding to emergencies involving hazardous materials; and 45

– 17 –

- *SB72*

9. Coordinate the activities administered by state agencies to 1 carry out the provisions of this chapter, 42 U.S.C. §§ 11001 et seq. 2 and 49 U.S.C. §§ 5101 et seq. 3 Sec. 25. NRS 603A.215 is hereby amended to read as follows: 4 603A.215 1. If a data collector doing business in this State 5 accepts a payment card in connection with a sale of goods or 6 services, the data collector shall comply with the current version of 7 the Payment Card Industry (PCI) Data Security Standard, as adopted 8 by the PCI Security Standards Council or its successor organization, 9 with respect to those transactions, not later than the date for 10 compliance set forth in the Payment Card Industry (PCI) Data 11 Security Standard or by the PCI Security Standards Council or its 12 successor organization. 13 2. A data collector doing business in this State to whom 14 subsection 1 does not apply shall not: 15 (a) Transfer any personal information through an electronic, 16 nonvoice transmission other than a facsimile to a person outside of 17 the secure system of the data collector unless the data collector uses 18 encryption to ensure the security of electronic transmission; or 19 (b) Move any data storage device containing personal 20 information beyond the logical or physical controls of the data 21 collector, its data storage contractor or, if the data storage device is 22 used by or is a component of a multifunctional device, a person who 23 assumes the obligation of the data collector to protect personal 24 information, unless the data collector uses encryption to ensure the 25 security of the information. 26 3. A data collector shall not be liable for damages for a breach 27 of the security of the system data if: 28 (a) The data collector is in compliance with this section; and 29 (b) The breach is not caused by the gross negligence or 30 intentional misconduct of the data collector, its officers, employees 31 or agents. 32 4. The requirements of this section do not apply to: 33 (a) A telecommunication provider acting solely in the role of 34 conveying the communications of other persons, regardless of the 35 mode of conveyance used, including, without limitation: 36 (1) Optical, wire line and wireless facilities; 37 (2) Analog transmission; and 38 (3) Digital subscriber line transmission, voice over Internet 39 protocol and other digital transmission technology. 40 (b) Data transmission over a secure, private communication 41 channel for: 42 (1) Approval or processing of negotiable instruments, 43 electronic fund transfers or similar payment methods; or 44

– 18 –

- *SB72*

(2) Issuance of reports regarding account closures due to 1 fraud, substantial overdrafts, abuse of automatic teller machines or 2 related information regarding a customer. 3 5. As used in this section: 4 (a) “Data storage device” means any device that stores 5 information or data from any electronic or optical medium, 6 including, but not limited to, computers, cellular telephones, 7 magnetic tape, electronic computer drives and optical computer 8 drives, and the medium itself. 9 (b) “Encryption” means the protection of data in electronic or 10 optical form, in storage or in transit, using: 11 (1) An encryption technology that has been adopted by an 12 established standards setting body, including, but not limited to, the 13 Federal Information Processing Standards issued by the National 14 Institute of Standards and Technology, which renders such data 15 indecipherable in the absence of associated cryptographic keys 16 necessary to enable decryption of such data; 17 (2) Appropriate management and safeguards of 18 cryptographic keys to protect the integrity of the encryption using 19 guidelines promulgated by an established standards setting body, 20 including, but not limited to, the National Institute of Standards and 21 Technology; and 22 (3) Any other technology or method identified by the [Office 23 of Information Security of the] Division of Enterprise Information 24 Technology Services of the Department of Administration in 25 regulations adopted pursuant to NRS 603A.217. 26 (c) “Facsimile” means an electronic transmission between two 27 dedicated fax machines using Group 3 or Group 4 digital formats that 28 conform to the International Telecommunications Union T.4 or T.38 29 standards or computer modems that conform to the International 30 Telecommunications Union T.31 or T.32 standards. The term does 31 not include onward transmission to a third device after protocol 32 conversion, including, but not limited to, any data storage device. 33 (d) “Multifunctional device” means a machine that incorporates 34 the functionality of devices, which may include, without limitation, 35 a printer, copier, scanner, facsimile machine or electronic mail 36 terminal, to provide for the centralized management, distribution or 37 production of documents. 38 (e) “Payment card” has the meaning ascribed to it in 39 NRS 205.602. 40 (f) “Telecommunication provider” has the meaning ascribed to it 41 in NRS 704.027. 42 Sec. 26. NRS 603A.217 is hereby amended to read as follows: 43 603A.217 Upon receipt of a well-founded petition, the [Office 44 of Information Security of the] Division of Enterprise Information 45

– 19 –

- *SB72*

Technology Services of the Department of Administration may, 1 pursuant to chapter 233B of NRS, adopt regulations which identify 2 alternative methods or technologies which may be used to encrypt 3 data pursuant to NRS 603A.215. 4 Sec. 27. 1. Notwithstanding any provision of law to the 5 contrary, the terms of office of the existing members of the 6 Information Technology Advisory Board appointed pursuant to 7 paragraphs (c) to (f), inclusive, of subsection 1 of NRS 242.122, 8 expire on June 30, 2015. 9 2. On or before July 1, 2015, the Governor shall appoint 10 members to the Information Technology Advisory Board that meet 11 the requirements set forth in paragraphs (c) and (e) of subsection 1 12 of NRS 242.122, as amended by section 8 of this act. 13 3. The terms of office of the members appointed pursuant to 14 this section is 4 years. 15 Sec. 28. The Legislative Counsel shall, in preparing 16 supplements to the Nevada Administrative Code, appropriately 17 change any references to any officer, agency or other entity: 18 1. Whose name is changed pursuant to the provisions of this 19 act; or 20 2. Whose responsibilities have been transferred pursuant to the 21 provisions of this act, to refer to the appropriate officer, agency or 22 other entity. 23 Sec. 29. NRS 233F.045, 233F.065, 242.105, 242.135 and 24 242.151 are hereby repealed. 25 Sec. 30. 1. This section and section 27 of this act become 26 effective upon passage and approval. 27 2. Sections 1 to 26, inclusive, and sections 28 and 29 of this act 28 become effective on July 1, 2015. 29

LEADLINES OF REPEALED SECTIONS

233F.045 “Communications Group” defined. 233F.065 “Telecommunications Group” defined. 242.105 Confidentiality of certain documents relating to homeland security: List; biennial review; annual report. 242.135 Employment of one or more persons to provide information services for agency or elected officer of State. 242.151 Administrator to advise agencies.

H